Malicious PDF — malware analysis report

Static analysis result for SHA-256 26e52c384a836c88…

MALICIOUS

PDF

86.1 KB Created: 2021-04-02 22:05:47 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2021-07-13
MD5: a68e71cc11e0dd3748e92d03748117c5 SHA-1: afc1772895f9a2e2f10f430e6ccdec8332af1602 SHA-256: 26e52c384a836c8830dd4b6f8be6a3b4d55a3eb101736bff78db1b0e4e6e8655
186 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many hosted on disposable domains, indicating a link farm or SEO spamming operation. ClamAV and ML classifiers identified this as a phishing or malicious PDF. While no scripts were explicitly extracted, the PDF structure and embedded links suggest an attempt to redirect users to potentially malicious websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9991

Heuristics 6

  • ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARM
    Small PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://nipisod.ru/award?keyword=badinerie+flute+pdf PDF link annotation
    • https://cdn.sqhk.co/neridisen/hg2aPic/aberdare_cables_catalogue.pdfIn PDF document text
    • https://cdn.sqhk.co/naxopesareg/YVMaicU/38724992664.pdfIn PDF document text
    • http://jumpfs.space/dofuzatasz8uv2.pdfIn PDF document text
    • http://davebamonuzove.medianewsonline.com/cara_menghilangkan_watermark_di_foxit_reader.pdfIn PDF document text
    • https://cdn.sqhk.co/xazururoxe/iahg9ic/brainpop_ell_login_and_password_2020.pdfIn PDF document text
    • http://sfhgfje5df.xyz/jixelifujirurumiwigaro2aj9f.pdfIn PDF document text
    • http://becloud.website/49870701798krm82.pdfIn PDF document text
    • http://gigezojiradof.scienceontheweb.net/autoimmune_protocol_diet.pdfIn PDF document text
    • http://fukiwurezopukof.mywebcommunity.org/what_is_the_attitude_of_the_poem_aunt_jennifers_tigers.pdfIn PDF document text
    • https://cdn.sqhk.co/sifolilo/9NDoLih/bottle_green_jumper_school.pdfIn PDF document text
    • http://naturagrush.space/57116461727cwad6.pdfIn PDF document text
    • https://cdn.sqhk.co/kedilexele/jeghThf/piruni.pdfIn PDF document text
    • https://cdn.sqhk.co/milatepoz/dvEgdgf/exodus_gods_and_kings.pdfIn PDF document text
    • http://heliusdesign.ru/42370247971mlvid.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://f50ece36-1901-4a7b-9396-968a400df7f4.filesusr.com/ugd/3ecb95_36fb86a001ab4166bdb01160d1d9ef98.pdf?index=trueIn PDF document text
    • https://8860adff-7f0b-4cf3-a358-cdd560dff136.filesusr.com/ugd/625844_e648ef33cb5b4fc29d01f843b5d15889.pdf?index=trueIn PDF document text
    • https://3794eb9c-cc8b-492c-aecc-44533f76aaa6.filesusr.com/ugd/1ee69b_4f5c43cdf5de4cc9ac0325a33a28f09d.pdf?index=trueIn PDF document text
    • http://xepatodop.onlinewebshop.net/88113540670.pdfIn PDF document text
    • https://0a9d52b7-bae8-445b-b6d2-8eba0f02533c.filesusr.com/ugd/729231_bdff8e3a98204b60855d9b7d48e85535.pdf?index=trueIn PDF document text
    • https://160e4e15-e27a-4ef2-9b26-f67fc0969a86.filesusr.com/ugd/cbdbb6_3ca672ac9a0f4ae78aec655b7ed3ff58.pdf?index=trueIn PDF document text
    • https://0306adf0-382e-42f1-903d-71c3961c97f1.filesusr.com/ugd/7ff653_e5f28d554e874cca99e65475910585d4.pdf?index=trueIn PDF document text
    • https://95043331-d9de-4498-ad98-35b8ac3ee23f.filesusr.com/ugd/5740b2_8e73d03be59149a3bdd31a005fa19132.pdf?index=trueIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ef84.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xEF84 4908 bytes
SHA-256: be0cb6daf1258c4f35e91fc4d506190e98b1a4b511b4c4eae1795c3e93540be2
font_01_sfnt_off0001003f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1003F 2060 bytes
SHA-256: bbe62571d967bdb1411a5e35c3e1558c665c432f259f41461023933dda876a1c
font_02_sfnt_off000109e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x109E7 12260 bytes
SHA-256: fdf39db82a03eb3a1a3f9b6e418c3e366b66766c0fc9e7474196e23dd66e0dbd
font_03_sfnt_off00013334.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13334 16184 bytes
SHA-256: 99308d2943c7867383f38f1c211846cc6735cce0880ded375eef66ea4f3e2d8c

Open this report in the interactive analyzer, or submit your own file for analysis.